Willi Ballenthin
2ec979469e
init show-object-layout using assemblage
2024-10-22 09:40:09 +00:00
Willi Ballenthin
2db0cc457f
detect user code via entry points (main function name)
2024-10-22 09:21:59 +00:00
Willi Ballenthin
3cad8d12af
mute unknown lines
2024-10-22 09:21:40 +00:00
Willi Ballenthin
5be96d7ddc
consider thunks library functions
2024-10-22 09:21:16 +00:00
Willi Ballenthin
4346922b9a
library-detection: add json output format
2024-10-21 10:42:30 +00:00
Willi Ballenthin
d652192af1
library-detection: cleanup script
2024-10-21 10:26:19 +00:00
Willi Ballenthin
f69602d085
library detection: rough integration of algorithms
2024-10-11 15:58:37 +00:00
Willi Ballenthin
ad187fc3bd
library detection: merge flirt and string branches
2024-10-11 13:43:10 +00:00
Willi Ballenthin
03ce40e781
initial attempt at library identification via known strings
2024-10-10 12:35:48 +00:00
Willi Ballenthin and Willi Ballenthin
76a4a5899f
test_scripts: avoid unsupported logic combinations
2024-06-07 05:54:49 +02:00
Willi Ballenthin and Willi Ballenthin
4d81b7ab98
rules: add references to existing issues
2024-06-07 05:54:49 +02:00
Willi Ballenthin and Willi Ballenthin
b068890fa6
rules: match: optimize rule matching by better indexing rule by features
...
Implement the "tighten rule pre-selection" algorithm described here:
https://github.com/mandiant/capa/issues/2063#issuecomment-2100498720
In summary:
> Rather than indexing all features from all rules,
> we should pick and index the minimal set (ideally, one) of
> features from each rule that must be present for the rule to match.
> When we have multiple candidates, pick the feature that is
> probably most uncommon and therefore "selective".
This seems to work pretty well. Total evaluations when running against
mimikatz drop from 19M to 1.1M (wow!) and capa seems to match around
3x more functions per second (wow wow).
When doing large scale runs, capa is about 25% faster when using the
vivisect backend (analysis heavy) or 3x faster when using the
upcoming BinExport2 backend (minimal analysis).
2024-06-07 05:54:49 +02:00
Willi Ballenthin and Willi Ballenthin
b59df659c9
pep8
2024-05-08 16:20:10 +02:00
Willi Ballenthin and Willi Ballenthin
519cfb842e
profile-time: more result reporting, and learn to specify other backends
2024-05-08 16:20:10 +02:00
Willi Ballenthin and Willi Ballenthin
f26a109b4d
pep8
2024-05-07 15:21:14 +02:00
Willi Ballenthin and Willi Ballenthin
d26897afca
capabilities: don't show progress bar when stderr is redirected to a file
2024-05-07 15:21:14 +02:00
Willi Ballenthin and Willi Ballenthin
6869ef6520
engine, common: use FeatureSet type annotation for evaluate signature
...
It was used in some places already, but now used everywhere consistently.
This should make it easier to refactor the FeatureSet type, if necessary,
because its easier to see all the places its used.
2024-05-07 15:20:50 +02:00
Willi Ballenthin and Willi Ballenthin
4fbd2ba2b8
capabilities: fix duplicate name
2024-05-07 15:20:16 +02:00
Willi Ballenthin and Willi Ballenthin
283ce41a5e
capabilities: only log "real" matched rules, not derived count
2024-05-07 15:20:16 +02:00
Willi Ballenthin and Willi Ballenthin
0f9dd9095b
fmt
2024-02-14 15:57:24 +01:00
Willi Ballenthin and Willi Ballenthin
b163f82a71
changelog
2024-02-14 15:57:24 +01:00
Willi Ballenthin and Willi Ballenthin
bd3cc18a25
loader: avoid eager imports of some backend-related code
2024-02-14 15:57:24 +01:00
Willi Ballenthin and Willi Ballenthin
4e2f175b9f
rules: don't eagerly import ruamel until needed
2024-02-14 15:57:24 +01:00
Willi Ballenthin and Willi Ballenthin
fdd097a141
main: remove unused imports
2024-02-14 15:57:24 +01:00
Willi Ballenthin and Willi Ballenthin
1b4e5258f8
elf: don't require vivisect just for type annotations
2024-02-14 15:57:24 +01:00
Willi Ballenthin and Willi Ballenthin
9929967634
changelog
2024-01-31 14:16:23 +01:00
Willi Ballenthin and Willi Ballenthin
3436aab3fd
proto: regenerate pyi with same protoc
2024-01-31 14:16:23 +01:00
Willi Ballenthin
3c159a1f52
ci: revert temporary CI event subscription
2023-11-29 14:26:53 +00:00
Willi Ballenthin
9a996d07c7
Merge branch 'dynamic-feature-extraction' of public.github.com:mandiant/capa into dynamic-feature-extraction
2023-11-29 13:46:47 +00:00
Willi Ballenthin
93cfb6ef8c
sync testfiles submodule
2023-11-29 13:46:29 +00:00
Willi Ballenthin
583f8b5688
Merge branch 'dynamic-feature-extraction' of public.github.com:mandiant/capa into dynamic-feature-extraction
2023-11-29 13:13:04 +00:00
Willi Ballenthin
b4c6bf859e
changelog
2023-11-29 13:12:30 +00:00
Willi Ballenthin
a870c92a2f
sync submodule rules
2023-11-15 11:00:51 +00:00
Willi Ballenthin
de5f08871e
sync submodule rules
2023-11-15 10:57:16 +00:00
Willi Ballenthin
987eb2d358
sync rules submodule
2023-11-14 14:34:08 +00:00
Willi Ballenthin
6e3fff4bae
use latest rules migration
2023-11-14 14:29:34 +00:00
Willi Ballenthin
82013f0e24
submodule: tests: data: sync
2023-11-14 10:35:18 +00:00
Willi Ballenthin
a52af3895a
verbose: remove TODOs
2023-11-06 10:37:22 +00:00
Willi Ballenthin
5d31bc462b
verbose: render dynamic match locations
2023-11-06 10:34:26 +00:00
Willi Ballenthin
7678897334
tests: fix render tests
2023-11-06 10:32:44 +00:00
Willi Ballenthin
75ff58edaa
vverbose: better render pid/tid/call index
2023-11-06 10:09:23 +00:00
Willi Ballenthin
eb12ec43f0
mypy
2023-11-06 09:52:00 +00:00
Willi Ballenthin
f7c72cd1c3
vverbose: don't repeat rendered calls when in call scope
2023-11-06 09:52:00 +00:00
Willi Ballenthin
0da614aa4f
vverbose: dynamic: show rendered matching API call
2023-11-06 09:52:00 +00:00
Willi Ballenthin
9c81ccf88a
vverbose: make missing names an error
2023-11-06 09:52:00 +00:00
Willi Ballenthin
c141f7ec6e
verbose: better render scopes
2023-11-06 09:52:00 +00:00
Willi Ballenthin
274a710bb1
report: better compute dynamic layout
2023-11-06 09:52:00 +00:00
Willi Ballenthin
9e6919f33c
layout: capture call names
...
so that they can be rendered to output
2023-10-20 14:21:13 +00:00
Willi Ballenthin
393b0e63f0
layout: capture process name
2023-10-20 12:39:28 +00:00
Willi Ballenthin
ee4f02908c
layout: capture process name
2023-10-20 12:38:35 +00:00
Willi Ballenthin
788251ba2b
vverbose: render scope for humans
2023-10-20 11:37:42 +00:00
Willi Ballenthin
1143f2ba56
changelog
2023-10-20 07:11:42 +00:00
Willi Ballenthin
10dc4b92b1
freeze: update freeze format v3
2023-10-20 06:59:53 +00:00
Willi Ballenthin
bfecf414fb
freeze: add dynamic tests
2023-10-20 06:59:34 +00:00
Willi Ballenthin
0231ceef87
null extractor: fix typings
2023-10-20 06:59:16 +00:00
Willi Ballenthin
c724a4b311
ci: only run BN and Ghidra tests after others complete
...
these are much less likely to fail because they're
changed less often, so don't run them until we know
other tests also pass.
2023-10-19 11:35:42 +00:00
Willi Ballenthin
84e22b187d
doc
2023-10-19 11:29:30 +00:00
Willi Ballenthin
b6a0d6e1f3
pre-commit: fix stages
2023-10-19 11:26:22 +00:00
Willi Ballenthin
1cb3ca61cd
pre-commit: only run fast checks during commit
2023-10-19 10:35:57 +00:00
Willi Ballenthin
288313a300
changelog
2023-10-19 10:28:37 +00:00
Willi Ballenthin
2cc6a37713
ci: run fast tests before the full suite
2023-10-19 10:23:03 +00:00
Willi Ballenthin
fbeb33a91f
Merge branch 'dynamic-feature-extraction' into fix/dynamic-proto
2023-10-19 10:05:26 +00:00
Willi Ballenthin
3519125e03
tests: fix COM tests with dynamic scope
2023-10-19 10:04:26 +00:00
Willi Ballenthin
98360328f9
proto: fix serialization of call address
2023-10-19 09:59:18 +00:00
Willi Ballenthin
3d4facd9a3
Merge branch 'dynamic-feature-extraction' into fix/dynamic-proto
2023-10-19 09:24:37 +00:00
Willi Ballenthin
8b0ba1e656
tests: rename freeze tests
2023-10-19 09:24:18 +00:00
Willi Ballenthin
7bc3fba7b0
Merge branch 'dynamic-feature-extraction' into fix/dynamic-proto
2023-10-19 09:20:15 +00:00
Willi Ballenthin
d5e187bc70
Merge branch 'master' into dynamic-feature-extraction
2023-10-19 09:15:57 +00:00
Willi Ballenthin
21f9e0736d
isort
2023-10-17 15:07:34 +00:00
Willi Ballenthin
55e4fddc51
mypy
2023-10-17 14:46:33 +00:00
Willi Ballenthin
1aac4a1a69
mypy
2023-10-17 14:42:58 +00:00
Willi Ballenthin
92daf3a530
elffile: fix property access
2023-10-17 14:28:52 +00:00
Willi Ballenthin
547502051f
dynamic: fix tests
2023-10-17 14:27:36 +00:00
Willi Ballenthin
7205bc26ef
submodule: rules: update
2023-10-17 12:28:45 +00:00
Willi Ballenthin
e1b3a3f6b4
rules: fix rendering of yaml
2023-10-17 12:22:32 +00:00
Willi Ballenthin
cb5fa36fc8
flake8
2023-10-17 11:44:48 +00:00
Willi Ballenthin
8ee97acf2a
dynamic: fix some tests
2023-10-17 11:43:09 +00:00
Willi Ballenthin
44d05f9498
dynamic: fix some tests
2023-10-17 11:41:40 +00:00
Willi Ballenthin
bf233c1c7a
integrate Ghidra backend with dynamic analysis
2023-10-17 10:56:35 +00:00
Willi Ballenthin
182a9868ca
merge master
2023-10-17 10:32:25 +00:00
Willi Ballenthin
72e836166f
proto: better convert to/from proto
2023-09-05 10:24:53 +00:00
Willi Ballenthin
d64ab41dfd
tests: proto: add more dynamic proto tests
2023-09-05 10:23:55 +00:00
Willi Ballenthin
5b4c167489
proto: add additional types
2023-09-05 10:23:30 +00:00
Willi Ballenthin
2a757b0cbb
submodule: test data: update
2023-09-05 10:22:59 +00:00
Willi Ballenthin
69836a0f13
proto: add dynamic test
2023-09-05 10:22:33 +00:00
Willi Ballenthin
866c7c5ce4
proto: deprecate metadata.analysis
2023-09-05 08:39:37 +00:00
Willi Ballenthin
3725618d50
render: proto: use Static/Dynamic analysis types
2023-09-05 08:37:11 +00:00
Willi Ballenthin
766b05e5c3
Merge branch 'dynamic-feature-extraction' into fix/dynamic-proto
2023-09-05 08:18:51 +00:00
Willi Ballenthin
88ee6e661e
wip: proto: add Metadata.[static, dynamic]_analysis
2023-08-25 14:40:50 +00:00
Willi Ballenthin
08c9bbcc91
proto: deprecate RuleMetadata.scope
2023-08-25 13:22:48 +00:00
Willi Ballenthin
f96b9e6a6e
proto: add RuleMetadata.scopes
2023-08-25 13:20:46 +00:00
Willi Ballenthin
9bbd3184b0
rules: handle unsupported scopes again
2023-08-25 13:15:55 +00:00
Willi Ballenthin
e4c1361d42
Merge branch 'fix/scope-enum-usage' into fix/dynamic-proto
2023-08-25 13:01:49 +00:00
Willi Ballenthin
17e4765728
changelog
2023-08-25 13:00:34 +00:00
Willi Ballenthin
a734358377
rules: use Scope enum instead of constants
2023-08-25 12:54:57 +00:00
Willi Ballenthin
ebcbad3ae3
proto: add new scopes
2023-08-25 12:21:37 +00:00
Willi Ballenthin
8ff74d4a04
proto: regenerate using 3.21 protoc
2023-08-25 12:20:51 +00:00
Willi Ballenthin
f2909c82f3
proto: reenable tests and linters
2023-08-25 09:41:25 +00:00
Willi Ballenthin
164b08276c
extractor: tweak hashes to fix mypy
2023-08-25 09:38:23 +00:00
Willi Ballenthin
9accb60eff
changelog
2023-08-25 09:11:04 +00:00
Willi Ballenthin